From c48132e89e5df27900c661487e48ffaf8c7c087d Mon Sep 17 00:00:00 2001
From: Denozordec <shatskiy.blog@gmail.com>
Date: Wed, 23 Sep 2026 14:51:38 +0700
Subject: [PATCH] =?UTF-8?q?fix(api):=20=D0=BE=D1=88=D0=B8=D0=B1=D0=BA?=
 =?UTF-8?q?=D0=B8=20=D1=82=D0=B8=D0=BF=D0=BE=D0=B2,=20=D1=81=D0=BA=D1=80?=
 =?UTF-8?q?=D1=8B=D1=82=D1=8B=D0=B5=20=D0=BE=D1=82=D1=81=D1=83=D1=82=D1=81?=
 =?UTF-8?q?=D1=82=D0=B2=D0=B8=D0=B5=D0=BC=20typecheck?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- jose v6 не экспортирует KeyLike → CryptoKey
- SimpleWebAuthn v13 требует Uint8Array<ArrayBuffer>
- targetType 'credential' в AUDIT_TARGET_TYPES (писался в аудит passkey-ов)
- target-app: начальные значения host/path/search никогда не читались
---
 apps/api/src/lib/target-app.ts         | 12 +++++-------
 apps/api/src/lib/webauthn.ts           | 11 ++++++-----
 packages/shared/src/contracts/audit.ts |  1 +
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/apps/api/src/lib/target-app.ts b/apps/api/src/lib/target-app.ts
index 27d70b7..5bcddc1 100644
--- a/apps/api/src/lib/target-app.ts
+++ b/apps/api/src/lib/target-app.ts
@@ -5,17 +5,15 @@ export function targetAppFromReturnTo(
   returnTo: string | undefined | null,
 ): AuditSourceApp {
   if (!returnTo) return 'portal'
-  let host = ''
-  let path = ''
-  let search = ''
+  let u: URL
   try {
-    const u = new URL(returnTo)
-    host = u.hostname.toLowerCase()
-    path = u.pathname.toLowerCase()
-    search = u.search
+    u = new URL(returnTo)
   } catch {
     return 'portal'
   }
+  const host = u.hostname.toLowerCase()
+  const path = u.pathname.toLowerCase()
+  const search = u.search
 
   // Portal OIDC authorize as return_to → map via client's redirect_uri
   if (path === '/oauth/authorize' || path.endsWith('/oauth/authorize')) {
diff --git a/apps/api/src/lib/webauthn.ts b/apps/api/src/lib/webauthn.ts
index 757fe09..9d1eb18 100644
--- a/apps/api/src/lib/webauthn.ts
+++ b/apps/api/src/lib/webauthn.ts
@@ -14,16 +14,17 @@ export function webauthnRelyingParty(app: FastifyInstance): {
   }
 }
 
-export function userIdToBytes(userId: string): Uint8Array {
-  return isoUint8Array.fromUTF8String(userId)
+export function userIdToBytes(userId: string): Uint8Array<ArrayBuffer> {
+  // Копия через конструктор даёт Uint8Array<ArrayBuffer>, которого требует SimpleWebAuthn v13.
+  return new Uint8Array(isoUint8Array.fromUTF8String(userId))
 }
 
-export function encodePublicKey(publicKey: Uint8Array): string {
+export function encodePublicKey(publicKey: Uint8Array<ArrayBuffer>): string {
   return isoBase64URL.fromBuffer(publicKey)
 }
 
-export function decodePublicKey(stored: string): Uint8Array {
-  return isoBase64URL.toBuffer(stored)
+export function decodePublicKey(stored: string): Uint8Array<ArrayBuffer> {
+  return new Uint8Array(isoBase64URL.toBuffer(stored))
 }
 
 export function asTransports(
diff --git a/packages/shared/src/contracts/audit.ts b/packages/shared/src/contracts/audit.ts
index 6727d0f..cce5e20 100644
--- a/packages/shared/src/contracts/audit.ts
+++ b/packages/shared/src/contracts/audit.ts
@@ -23,6 +23,7 @@ export const AUDIT_TARGET_TYPES = [
   'session',
   'system',
   'app_resource',
+  'credential',
 ] as const
 export type AuditTargetType = (typeof AUDIT_TARGET_TYPES)[number]
 export const auditTargetTypeSchema = z.enum(AUDIT_TARGET_TYPES)